Relying on a single password for more than one purpose, e.g. logging on to your web-mail, instant messaging service, Facebook, Bebo, etc. is probably very commonplace. Indeed, exposés such as Twitterank, and even it’s parody site TwitterAwesomeness, highlight the ease at which folks will essentially surrender their username and passwords. Twitterank didn’t just catch the unsuspecting Internet user, they also caught a number of people who really should have known better.

Sites that do need your Twitter username and password, such as BrightKite, use it in order to post tweets on your behalf. In BrightKite’s case, it tweets each time you “check in” to their “where am I” service. The check-in process involves you telling BrightKite where you are, it then sends out a Tweet telling the world. Such sites make their intentions very clear in the Terms Of Use, Code of Conduct and Privacy pages.

However, so did Twitterank. The site made it clear what it wanted you to believe it was doing with your username and password. Even if you didn’t read the Twitterank terms of service or FAQ, it was embedded within the source code, as Barry Dorrans carefully points out. The speed at which the Twitter population flocked to Twitterank suggests that were there any ulterior motives, the site would be well placed to exploit a significant portion of the Twitter accounts that it had opportunity to harvest.

Twitterank was different. It relied on our instinctual want to graded or rank ourselves amongst our peers. No matter how hard we try, we’re all competitive by nature. We want to know where we stand/sit in relation to our peers. Some services, such as Twitter Grader have managed to achieve this without the need for a Twitter password. Granted there’s only so much Twitter Grader can do, however it’s a polite service that has introduced me to a number of Twitter users in Scotland – users that I may not have discovered.

There was little indication whether a Twitterank of 100 was good or bad. Some users reported ranks of over 200, others, as we’ve seen already, received a rank of zero. The mathematics behind the site were reported via a comment in this blog as being “Real Math(tm)” and were comparable in accuracy to Google’s PageRank mechanism. I’m not a mathematician so I won’t be debunking any formula, algorithm or approaches. Well, not just yet at least. For Twitterank to have been useful, it would need to allow us to determine whether our rank was better or worse than other Twitterankers (there it is again, I do apologise).

Twitterank didn’t really try to hide its intentions, however because of the the site’s ease of use, instant gratification and rapid publicity, its uptake was huge (it trended TweetStats and Twitter Search, and at the time of writing, continues to do so – outdoing “Obama” and “James Bond”). The publicity was part of what made it so popular – it sent out a Tweet announcing your Twitterank, including a link back to the site thus encouraging users to discover their own ranking. In most cases, this would probably be fine, however spare a thought for the Twitter folks who received a ranking of zero – and there where many of them! Indeed, many Twitterankers (can I really get away with saying that? Too late now!) tweeted their dissatisfaction at their ranking.

Amusingly, Twitterank’s creator (@ryochiji) reported on his Twitter feed that low rankers should try again tomorrow. Oh, so that’s how it works – everybody’s Twitterank will improve over time, that’ll work, great system, yes? Further information may be found on the Twitterank blog, assuming WordPress haven’t deemed it necessary to close it down.

It’s not all about gullible users though This morning, at the time of writing, a few hours after Twitterank was exposed for the social experiment that it probably is (or was), saw me reading Bruce Schneier‘s Read me first column in the Technology section of The Guardian. Bruce writes a great piece explaining how passwords don’t need to be broken per say, but that they are inherently easy to guess.

Without spoiling the article too much, assuming that you are going to read it, Bruce highlights our password selection techniques. One such method, and one that is certainly very familiar to this writer in his corporate environment, is the keyword+appendage approach. Users often take their child’s name, their dog’s name, etc. and add a numeric digit or two after the name, e.g. frank01 or rover12.

Today’s processing power means that software can intelligently guess huge combinations of keyword+appendage passwords in a relative short and acceptable period of time. Gone are the days when passwords would take days or weeks to crack. If you need more convincing, think about how long it takes the average WiFi hacker to crack your wireless router/modem WEP encryption keys. Or even your WPA encryption?

Bruce makes the suggestion of using a personal sentence as your password. Not the sentence itself, but an obfuscated version of the sentence. His example (yes I’m spoiling the original article, sorry) uses “This little piggy went to market” – it creates an obfuscated password of tlpWENT2m. Such as password would take a significant amount of time to be guessed using processing power alone. Just in case you were tempted, Bruce rightfully advises that we don’t use tlpWENT2m ourselves…oddly enough.

Increasing security, some options With the ease at which Twitterank coaxed visitors into typing in their username and password, it seems the days of the password as a single source of authentication are numbered. We need to be considering more secure alternatives that involve “levels of authentication”. Usablity is the key to widespread acceptance, any product in this space must be easy to use; its interface must be fundamental such that selection of a secure-level authentication token requires little more effort than offering a basic-level token.

With Twitterank-like incidents becoming more common, I predict that during 2009 we will see the general acceptance and widespread uptake of such authentication mechanisms such as OpenID, and CardSpace (further reading here and here). You should familiarise yourself with these mechanisms because major web-sites such as Yahoo are gradually introducing them as part of their login process. Indeed, even the likes of Facebook, where you can be whoever you want to be, may have to succumb and implement a more secure user registration and identity verification process.

Beyond authentication into verificationGoing beyond authentication, we need to consider verification, particularly of identity. The internet has little in the way of process that can help us confirm an individual’s authenticity and identity – how do you know that the person your are tweeting with or Facebooking is the person they say they are? Twitter had the great fake Sarah Silverman incident of October 2008. Facebook has many impersonation cases, a few of which I discuss in elsewhere on this blog.

Firms, such as NetIDme are well placed to take advantage of the needs of the authentication and identity verification marketplace. Identity verification through NetIDme processes involves a combination of stages, if you’re in the UK or US they boast a 95% “automatic verification” rate. The remaining 5%, or if you are a child, requires some form of personal contact with the NetIDme team – whether it is a fax or a phone call. However, prior to the personal contact, you are invited to provide such things as your Driving Licence Number, National Insurance number, Social Security Number or Passport number in order for third party checks to take place. Obviously this is much more involved and potentially more invasive than a simple username/password combination. The fact we are now able to authenticate and verify who we are, including how old we are, is a key step forward in the growth and maturity of the Internet.

And finally… At the time of writing Twitterank is still up and running, whilst there appears to be no malicious intent on the creator’s part, the whole debacle in the social engineering space has left a bitter taste in the mouths of many people. I am sure that no ill intent was ever on the cards, however Twitterank has proven that everybody needs to think about their own on-line security and the implications of password surrender.

Just think what might have happened to your Twitter feed? “Ah,” you say, “but it’s just my Twitter feed, I don’t really care if somebody hacks it and owns it.” That’s fine, but a lot of users have a single password, and that is where the problem stems from. Identity theft often starts from the smallest thing. I have a colleague whose identity was stolen simply because she left her name on the door bell of her previous house. The house had been sold to a gentleman who then let / rented the house. The new tenants used the knowledge of the previous owner’s name to start off the identity theft process. It is that simple.

I’ll leave you with advice that is mentioned elsewhere in this blog:

Don’t use the same password for social networking sites and services that are more important to you such as your on-line bank or your web-mail. If your password is harvested, as Twitterank could have done, you may find yourself compromised in more than one way.

Avoid simple passwords such as “password”, “itsasecret” or “letmein”. Amazingly, during my university days somebody actually told me their password was “itsasecret”. Indeed it was…I logged in and was later accused of cracking the said password. A little trouble ensued but it was soon dropped when I explained that i had actually been given the password in the first place!

Consider “upping” your levels of security your OpenID – there are plenty of providers. Yahoo, MyOpenID and NetIDme to name just a few. Any progress in this direction, is good progress. Of course, you could always demand OpenID!

As many of you are probably aware, earlier this week I noticed that my trusty WordPress blog was duping me into downloading and installing an essential security upgrade to version 2.6.4. At the time, I was running version 2.5.1. You’re possibly wondering why I had not already upgraded to an authentic WordPress 2.6.x release…I am after all, supposed to be setting an example. Well, a number of factors delayed the upgrade – most notably lots of travel and a few time-consuming home-life issues meant the upgrade was back-burner-ed. Via The Register, Sophos picked up on hack, classifying it as Troj/WPHack-A. I managed to record a short video of the dashboard hack, notice that I’m at WordPress 2.6.3…

That being said, a small part of me always prefers to wait a while before upgrading, i.e. I don’t like to upgrade immediately. If memory serves me, I recall a WordPress upgrade that caused me a few minor problems because I upgraded the moment it came out – it was soon followed by a further release. Anyway, I’m digressing.

Since Monday, I have upgraded to WordPress 2.6.3, twice. Naturally I used the definitive link for getting my hands on the 2.6.3 zip file. On both occasions the WordPresz 2.6.4 upgrade advice was still appearing in my dashboard. I’ve also been liaising with the good folks over at WordPress and have followed as much of their advice as I can at this stage. Huge thanks to the WordPress chaps for picking up on this issue – whilst it hasn’t affected me, I’m sure some folks have accidentally installed the fake 2.6.4 release.

My second install of 2.6.3 saw me cleaning out the various wp-admin, wp-includes, folders and then FTPing a fresh 2.6.3 set of files. I then started poking around in the WordPress database – table wp_options caught my attention. Themes tend to leave a lot of fingerprints in wp_options, as do a number of plug-ins. I cleaned out around about 40% of the wp_options records that were related to themes I no longer have installed.

After further searching, I found the field dashboard_widget_options:

As you can see, the WordPresz 2.6.4 injection text, or at least part of it, is in there. In order to remove it from my dashboard, I simply removed the entire contents of the dashboard_widget_options field, i.e. its content is empty – I did not delete the entire record. WordPress was kind enough to recreate the contents of this record.

Further poking around in wp_options revealed an RSS record: rss_412e29f6467d015b137ccc293b42bdff. Its contents were familiar:

O:9:”MagpieRSS”:17:{s:6:”parser”;i:0;s:12:”current_item”;a:0:{}s:5:”items”;a:1:{i:0;a:4:{s:5:”title”;s:43:”High risk vulnerability for WordPress users”;s:11:”description”;s:132:”High risk vulnerability for WordPress users, we wanted to get an update out immediately. 2.6.4 is available for download right now.”;s:4:”link”;s:21:”http://wordpresz.org/”;s:7:”summary”;s:132:”High risk vulnerability for WordPress users, we wanted to get an update out immediately. 2.6.4 is available for download right now.”;}}s:7:”channel”;a:7:{s:5:”title”;s:43:”High risk vulnerability for WordPress users”;s:4:”link”;s:21:”http://wordpresz.org/”;s:11:”description”;s:29:”Just another WordPress weblog”;s:13:”lastbuilddate”;s:31:”Thu, 30 Oct 2008 02:29:53 +0000″;s:4:”docs”;s:34:”http://backend.userland.com/rss092″;s:8:”language”;s:2:”en”;s:7:”tagline”;s:29:”Just another WordPress weblog”;}s:9:”textinput”;a:0:{}s:5:”image”;a:0:{}s:9:”feed_type”;s:3:”RSS”;s:12:”feed_version”;s:4:”0.92″;s:5:”stack”;a:0:{}s:9:”inchannel”;b:0;s:6:”initem”;b:0;s:9:”incontent”;b:0;s:11:”intextinput”;b:0;s:7:”inimage”;b:0;s:13:”current_field”;s:0:””;s:17:”current_namespace”;b:0;s:19:”_CONTENT_CONSTRUCTS”;a:6:{i:0;s:7:”content”;i:1;s:7:”summary”;i:2;s:4:”info”;i:3;s:5:”title”;i:4;s:7:”tagline”;i:5;s:9:”copyright”;}}

I elected to remove (delete) that record (rss_412e29f6467d015b137ccc293b42bdff and rss_412e29f6467d015b137ccc293b42bdff_ts – I would imagine your field names might look a little different to mine).

My WordPress 2.6.3 install is now looking a little healthier. However there are still a number of unanswered questions. How did the 2.6.4 information make its way into the wp_options table? Was it a WordPress or a MySQL exploit or was it something else? Has my MySQL database password been comprised in some way? What about my FTP password? Was a malicious theme responsible for this compromise? I am very close to developing a theme myself, hopefully that learning curve will help me find answers to some of these questions. Who knows the answers to these questions? Hopefully over time the truth will out, I would certainly like to know.

Whatever the case, my blog hasn’t been visibly owned as yet…I suppose time will tell. In the meantime, password changes are aplenty!

As some of you may know, I’ve been doing some stats recently – there must be something in the air!

Anyway, as part of another stats gathering exercise, I found myself looking at a list of blog entries that I had made over the past 12 months to October 2008. Looking at the list, it was obvious that there were a couple of significant dips and the odd peak. The dips were typically the result of [business] travel to London. The peaks were the result of a Microsoft product launch and the use of a single post to capture “my week” – largely to document the trials and tribulations of business travel, but occasionally to capture other more interesting events!

They are taking the form of “…wrote an interesting post today on…” – the “person” making the comment and their URL look reasonable enough, except the URL points to a copy of the original post and a shed load of useless adverts. For example:

[…] The Social Programmer wrote an interesting post today on DDD6 – The Recruitment Panel – Your help is needed!Here’s a quick excerpt Colin needs your help! Whilst we’re still voting for the DDD6 sessions, … : Founder of Girl Geek Dinners and software Engineer at Cardinal Health. She has grown up around technology … Insurance Services in Glasgow. His team writes enterprise applications for internal customers using […]

The same trick has come from a couple of domains, I’m tempted to blacklist anything that has “wrote an interesting post today on”, however not right away.

Has anybody else hit upon this problem? Any solutions?

I’m using WordPress 2.3 with Spam Karma. I’ve not looked at Akismet, should I be running that too?

So, in order to demonstrate what I see as a problem with a theme, here are couple of examples.

Firstly, this one was a perfectly good theme, however notice how the Comments (1) has lost the trailing )

And this one was great too, but why does the post count have to appear on a new line?

Yes, they are probably easy enough to fix, but that means hacking the theme…and when an upgrade to the theme comes along, I’ll have to remember to extract the hacks and re-apply them. Not fun. I’m probably going to have to write my own theme, who knows when I’ll have the time do to that.

In the meantime, whilst I’m happy enough with this Clean [BlueHaze] theme (it’s a 3-column theme, but the left-most column makes it feel like a 4-column theme), I’d be happy to receive recommendations for 3 column themes, minimal, fluid (i.e. wide content area), decent configuration for the column widths, WordPress 2.3 compliant and no hacks required.